loki-mode 9.22.12 → 9.24.0

package/autonomy/run.sh

@@ -967,6 +967,36 @@ _loki_provider_pipeline_exit_code() {
     fi
 }
 
+# Invoke through a provider's argv-builder seam while preserving the main
+# loop's deadline, fan-out logging, and provider-stage exit status.
+_loki_invoke_argv_provider() {
+    local tier="${1:-development}"
+    local prompt="${2:-}"
+    local log_file="${3:-}"
+    local agent_log="${4:-}"
+    local iter_output="${5:-}"
+    local -a _loki_argv_pipe_status=()
+
+    if ! type provider_invoke_argv >/dev/null 2>&1; then
+        log_error "Provider ${PROVIDER_NAME:-unknown} does not implement provider_invoke_argv"
+        return 125
+    fi
+    if ! provider_invoke_argv "$tier" "$prompt" \
+        || [ "${#_LOKI_INVOKE_ARGV[@]}" -eq 0 ]; then
+        log_error "Provider ${PROVIDER_NAME:-unknown} failed to build invocation argv"
+        return 125
+    fi
+
+    LOKI_DEADLINE_IDLE_TIMEOUT="${LOKI_PROVIDER_IDLE_TIMEOUT:-0}" \
+    _loki_with_deadline "${LOKI_PROVIDER_CALL_TIMEOUT:-0}" \
+        "${_LOKI_INVOKE_ARGV[@]}" 2>&1 \
+        | tee -a "$log_file" "$agent_log" "$iter_output"
+    _loki_argv_pipe_status=("${PIPESTATUS[@]}")
+    return "$(_loki_provider_pipeline_exit_code \
+        "${_loki_argv_pipe_status[0]:-125}" \
+        "${_loki_argv_pipe_status[1]:-125}" 0)"
+}
+
 _LOKI_DEPENDENCY_SETUP_LIB="${SCRIPT_DIR}/lib/dependency-setup.sh"
 if [ -r "$_LOKI_DEPENDENCY_SETUP_LIB" ]; then
     # shellcheck source=lib/dependency-setup.sh
@@ -1519,20 +1549,20 @@ PYREG
 # if any other project is still running (KEEP) it is left up. NEVER uses a
 # blanket pkill and NEVER touches another folder's pids. Best-effort and
 # failure-swallowed: teardown bookkeeping must never block a clean exit.
-# Is this pid plausibly OUR dashboard, or a recycled number now naming something
-# else? Fails OPEN (returns 0) whenever ps cannot tell us, so the only behavior
-# change is refusing to kill a process that is positively identified as NOT a
-# dashboard. See the call site for the measured stale-file evidence.
+# Is this pid positively identified as our dashboard, rather than a recycled
+# number now naming something else? Ownership-sensitive cleanup must fail closed:
+# an absent `ps` result is not evidence, and a generic python/loki substring is
+# not specific enough to authorize a signal.
 _loki_pid_looks_like_dashboard() {
     local _p="$1" _cmd
     case "$_p" in ''|*[!0-9]*) return 1 ;; esac
     [ "$_p" -gt 1 ] 2>/dev/null || return 1     # never signal pid 0/1
     _cmd="$(ps -o command= -p "$_p" 2>/dev/null)"
-    [ -n "$_cmd" ] || return 0                   # ps unavailable: behave as before
-    case "$_cmd" in
-        *dashboard*|*uvicorn*|*loki*) return 0 ;;
-    esac
-    return 1
+    [ -n "$_cmd" ] || return 1
+    # run.sh and `loki dashboard start` both launch this exact module form.
+    # Anchor the interpreter and module tokens so an unrelated command merely
+    # mentioning "dashboard.server" in an argument cannot forge identity.
+    [[ "$_cmd" =~ ^[[:space:]]*([^[:space:]]*/)?[Pp]ython([0-9]+([.][0-9]+)*)?[[:space:]]+-m[[:space:]]+dashboard[.]server([[:space:]]|$) ]]
 }
 
 loki_mark_project_stopped_and_maybe_kill_shared_dashboard() {
@@ -1591,9 +1621,10 @@ PYCHECK
             #
             # kill -0 is NOT sufficient: a recycled pid is alive by definition,
             # which is exactly the insufficiency the loki.pgid self-check had.
-            # Mirrors _app_runner_pid_is_ours (app-runner.sh:242) and fails OPEN
-            # the same way -- if `ps` says nothing we signal as before, so a
-            # legitimate dashboard is never left running by this check.
+            # This guard fails CLOSED: if `ps` says nothing, or says something
+            # that is not the dashboard's own command, we do not signal. The
+            # cost of failing closed is a leaked dashboard the next explicit
+            # stop reaps; the cost of failing open was signalling a stranger.
             if [ -n "$_shared_pid" ] && _loki_pid_looks_like_dashboard "$_shared_pid"; then
                 kill "$_shared_pid" 2>/dev/null || true
                 sleep 0.5
@@ -1601,27 +1632,11 @@ PYCHECK
             fi
             rm -f "$_shared_pidfile" 2>/dev/null || true
         fi
-        # (d) Defense-in-depth: reclaim the dashboard port only in the CLEAR
-        # case, so we never kill a shared dashboard another project owns.
-        # BUT never kill a HEALTHY dashboard already serving on the port: that is
-        # almost always the user's own live dashboard (open in their browser), and
-        # killing it mid-use drops their session (ERR_CONNECTION_REFUSED, WS fail).
-        # A healthy server is reusable by every project, so probe /api/status first
-        # and only reclaim the port when nothing is answering (a genuinely stale
-        # listener). Opt out of the probe with LOKI_DASHBOARD_FORCE_RECLAIM=1.
-        if command -v lsof >/dev/null 2>&1; then
-            local _dash_port="${DASHBOARD_PORT:-57374}"
-            local _dash_alive=""
-            if [ "${LOKI_DASHBOARD_FORCE_RECLAIM:-}" != "1" ] && command -v curl >/dev/null 2>&1; then
-                _dash_alive=$(curl -s -o /dev/null -w '%{http_code}' --max-time 1 \
-                    "http://127.0.0.1:${_dash_port}/api/status" 2>/dev/null || true)
-            fi
-            if [ "$_dash_alive" = "200" ]; then
-                log_info "Reusing the healthy dashboard already serving on port ${_dash_port} (not reclaiming)."
-            else
-                lsof -ti:"${_dash_port}" -sTCP:LISTEN 2>/dev/null | xargs kill 2>/dev/null || true
-            fi
-        fi
+        # A port number and an HTTP response are not ownership evidence. In
+        # particular, a 404 can be an unrelated healthy service. The shared PID
+        # file plus positive command identity above is the only authority to
+        # signal a process; absent or forged ownership leaves every port holder
+        # untouched.
     fi
 }
 # Register as running now. We deliberately do NOT install an EXIT trap to
@@ -3207,7 +3222,7 @@ validate_api_keys() {
         # "loggedin" or "unknown" -> proceed (fail open on uncertainty).
     fi
 
-    # CLI tools (claude, codex, cline, aider) use their own login sessions.
+    # CLI tools (claude, codex, cline, aider, opencode) use their own login sessions.
     # Only require API keys inside Docker/K8s where CLI login isn't available.
     if [[ ! -f "/.dockerenv" ]] && [[ -z "${KUBERNETES_SERVICE_HOST:-}" ]]; then
         return 0
@@ -13425,6 +13440,43 @@ _loki_requirements_contract_emit() {
         "${LOKI_REVIEW_REQUIREMENTS_IDENTITY:-}"
 }
 
+# A reviewer dispatch can die BEFORE the provider is ever invoked -- the
+# prompt rematerialization or the shard-identity lookup below both exit 125
+# while LOKI_REVIEW_STDERR_FILE is still unset and no timing sidecar exists
+# yet. That left a lost shard structurally invisible: the logical aggregation
+# (REQUIREMENTS_LOGICAL_TIMING) substituted an anonymous placeholder and the
+# only symptom was a bare call count that could not name WHICH shard vanished.
+# Emit the same sidecar the completed path emits, plus one bounded stderr
+# line, so the existing aggregation carries a shard-identifying cause.
+# ponytail: fixed-format single line, no truncation helper needed.
+_dispatch_reviewer_prestub_failure() {
+    local review_output="$1" stderr_output="$2" stage="$3" shard_index="${4:-0}"
+    printf 'loki-review-prestub-failure stage=%s shard_index=%s reviewer=%s\n' \
+        "$stage" "$shard_index" "${5:-unknown}" >> "$stderr_output" 2>/dev/null || true
+    chmod 600 "$stderr_output" 2>/dev/null || true
+    _LOKI_RDT_PATH="${review_output%.txt}-timing.json" \
+    _LOKI_RDT_STAGE="$stage" _LOKI_RDT_SHARD="$shard_index" \
+    _LOKI_RDT_STDERR="$stderr_output" \
+    _LOKI_RDT_BUDGET="${LOKI_REVIEW_CALL_TIMEOUT:-0}" python3 - <<'REVIEW_PRESTUB_TIMING' 2>/dev/null || true
+import json
+import os
+
+record = {
+    "schema": "loki-review-dispatch/v1",
+    "budget_seconds": int(os.environ.get("_LOKI_RDT_BUDGET", "0") or 0),
+    "elapsed_ms": 0,
+    "exit_code": 125,
+    "outcome": "prestub_error",
+    "deadline_scope": "pre_dispatch",
+    "stage": os.environ.get("_LOKI_RDT_STAGE", "unknown"),
+    "shard_index": int(os.environ.get("_LOKI_RDT_SHARD", "0") or 0),
+    "stderr_bytes": os.path.getsize(os.environ["_LOKI_RDT_STDERR"]),
+}
+with open(os.environ["_LOKI_RDT_PATH"], "w", encoding="utf-8") as handle:
+    json.dump(record, handle, sort_keys=True)
+REVIEW_PRESTUB_TIMING
+}
+
 # Persist one compact record per provider review. The sidecar is written by the
 # same process that owns the dispatch, so parallel reviewer timings do not get
 # distorted by the parent's ordered wait loop.
@@ -15373,7 +15425,13 @@ BUILD_PROMPT
             prompt_text=$(python3 "$requirements_helper" read-bound \
                 "$review_prompt_file" "$prompt_sha" \
                 "$_review_max_prompt_bytes" "$prompt_identity" 2>/dev/null) \
-                || exit 125
+                || {
+                    _dispatch_reviewer_prestub_failure \
+                        "$review_stage_file" \
+                        "$review_dir/$review_id/${reviewer_name}-stderr.log" \
+                        prompt_read_bound "$reviewer_shard_index" "$reviewer_name"
+                    exit 125
+                }
             if [ "$reviewer_logical_name" = "requirements-verifier" ]; then
                 local shard_label shard_identity
                 printf -v shard_label '%03d' "$reviewer_shard_index"
@@ -15381,7 +15439,13 @@ BUILD_PROMPT
                     _LOKI_REVIEW_SHARD_INDEX="$reviewer_shard_index" python3 -c '
 import json, os
 print(json.loads(os.environ["_LOKI_REVIEW_SHARD_IDENTITIES"])[int(os.environ["_LOKI_REVIEW_SHARD_INDEX"]) - 1])
-') || exit 125
+') || {
+                    _dispatch_reviewer_prestub_failure \
+                        "$review_stage_file" \
+                        "$review_dir/$review_id/${reviewer_name}-stderr.log" \
+                        shard_identity "$reviewer_shard_index" "$reviewer_name"
+                    exit 125
+                }
                 LOKI_REVIEW_REQUIREMENTS_HELPER="$requirements_helper" \
                 LOKI_REVIEW_REQUIREMENTS_SOURCE="$requirements_source" \
                 LOKI_REVIEW_REQUIREMENTS_SNAPSHOT="$requirements_file" \
@@ -16557,9 +16621,16 @@ start_dashboard() {
         # Check if it's our own dashboard
         local existing_pid=$(lsof -ti :$DASHBOARD_PORT 2>/dev/null | head -1)
         if [ -n "$existing_pid" ]; then
-            # Only kill if it's a Python/uvicorn dashboard process
+            # Only kill a process positively identified as OUR dashboard.
+            # `-o comm=` yields just the executable name ("python3"), so the old
+            # *python*/*uvicorn* test matched ANY python process that happened to
+            # hold this port -- an unrelated http.server answering 404 was killed
+            # as a "stuck dashboard". Reuse the same full-command-line guard the
+            # teardown path uses: it fails closed on an unreadable or foreign
+            # command, so a stranger on this port is stepped over (port++) rather
+            # than signalled.
             local proc_cmd=$(ps -p "$existing_pid" -o comm= 2>/dev/null || true)
-            if [[ "$proc_cmd" == *python* ]] || [[ "$proc_cmd" == *uvicorn* ]]; then
+            if _loki_pid_looks_like_dashboard "$existing_pid"; then
                 # Never kill a HEALTHY dashboard already serving here: it is almost
                 # always the user's own live dashboard (open in their browser), and
                 # killing it on `loki start` drops their session mid-use. A healthy
@@ -16731,7 +16802,32 @@ start_dashboard() {
         return 1
     fi
 
-    sleep 2
+    # Wait for the dashboard to come up, but only as long as it actually takes.
+    # This was a flat `sleep 2` on the critical path of every build, before the
+    # first iteration, spent entirely on a process that is typically serving in
+    # a fraction of that. Poll the endpoint the reuse path above already trusts
+    # (/api/status), so this returns the moment the server really serves rather
+    # than on a fixed guess.
+    #
+    # The floor is deliberate and NOT an optimization target. A process that
+    # starts and then dies at t=1.5s would pass an early `kill -0` where the old
+    # flat sleep would have caught it, so polling alone would trade a real
+    # liveness check for a second of wall clock. We keep polling until the
+    # endpoint answers AND require the process to still be alive at the end,
+    # which is strictly stronger than the old single check at t=2s.
+    _dash_ready=0
+    for _ in $(seq 1 40); do
+        kill -0 "$DASHBOARD_PID" 2>/dev/null || break
+        if curl -fsS -m 1 "http://127.0.0.1:${DASHBOARD_PORT}/api/status" >/dev/null 2>&1; then
+            _dash_ready=1
+            break
+        fi
+        sleep 0.05
+    done
+    # A server that never answered still gets the original grace period: some
+    # environments have no curl, and the endpoint is not the only thing that
+    # makes a dashboard useful. Falling back keeps behavior identical there.
+    [ "$_dash_ready" = "1" ] || sleep 2
 
     if kill -0 "$DASHBOARD_PID" 2>/dev/null; then
         DASHBOARD_LAST_ALIVE=$(date +%s)
@@ -23266,6 +23362,16 @@ if __name__ == "__main__":
                 } && exit_code=0 || exit_code=$?
                 ;;
 
+            opencode)
+                # Keep argv construction provider-owned: its prompt is
+                # positional, --auto is mandatory, and the model is provider
+                # scoped. The wrapper preserves the main-loop deadline/tee
+                # contract and returns the provider stage's nonzero status.
+                _loki_invoke_argv_provider "$CURRENT_TIER" "$prompt" \
+                    "$log_file" "$agent_log" "$iter_output"
+                exit_code=$?
+                ;;
+
             *)
                 log_error "Unknown provider: ${PROVIDER_NAME:-unknown}"
                 local exit_code=1
@@ -25745,7 +25851,7 @@ main() {
                     fi
                     shift 2
                 else
-                    log_error "--provider requires a value (claude, codex, cline, aider)"
+                    log_error "--provider requires a value (claude, codex, cline, aider, opencode)"
                     exit 1
                 fi
                 ;;
@@ -25992,6 +26098,18 @@ main() {
         exit 1
     fi
 
+    # BOOT WINDOW (v9.24.0). Everything from here to setup_agent_branch is
+    # pre-loop setup: prerequisites, provider detection, complexity detection,
+    # dashboard start, branch setup. None of it was timed, and none of the nine
+    # existing emit_stage_complete sites lies outside the iteration body -- so
+    # on the one profiled build, stage_total_s summed to 723s against a 960s
+    # wall clock and 237s (25%) was attributed by GUESS, not measurement
+    # (benchmarks/results/gate-profile.json). The guess named "rsync of the
+    # engine copy", which measurement later falsified: the only rsync in the
+    # repo is in the benchmark harness, costs 1.09s, and runs before the timer
+    # starts. Bracket the window instead of arguing about it.
+    _boot_t0=$(date +%s 2>/dev/null)
+
     # Check prerequisites (unless skipped)
     if [ "$SKIP_PREREQS" != "true" ]; then
         if ! check_prerequisites; then
@@ -26207,6 +26325,11 @@ main() {
     # Setup agent branch protection (isolates agent changes to a feature branch)
     setup_agent_branch
 
+    # Close the boot window. Purely additive: emit_stage_complete appends one
+    # event line and swallows every error, so it cannot alter a gate verdict or
+    # control flow (see its contract at run.sh:2523-2531).
+    emit_stage_complete "boot" "pass" "$_boot_t0"
+
     # Log session start for audit
     audit_log "SESSION_START" "prd=$PRD_PATH,dashboard=$ENABLE_DASHBOARD,staged_autonomy=$STAGED_AUTONOMY,parallel=$PARALLEL_MODE"
     audit_agent_action "session_start" "Session started" "prd=$PRD_PATH,provider=${PROVIDER_NAME:-claude}"
@@ -26303,6 +26426,11 @@ main() {
         # a stuck "Planning" state.
         _advance_current_phase "BUILDING"
         run_autonomous "$PRD_PATH" || result=$?
+        # TEARDOWN WINDOW (v9.24.0): the other half of the unmeasured 237s.
+        # Everything after the loop -- pre-edit snapshot, commit, handoff and
+        # learnings writers, proof generation, metrics aggregation -- runs here
+        # and was never timed. Opened immediately so nothing below is missed.
+        _teardown_t0=$(date +%s 2>/dev/null)
         # PRE-EDIT SNAPSHOT: freeze the agent's raw diff HERE, the first
         # instruction after the loop returns, because everything below this line
         # can change the tree -- commit_session_changes commits the work (after
@@ -26497,6 +26625,14 @@ except Exception:
         generate_proof_of_run "$result" || true
     fi
 
+    # Close the teardown window here rather than after cleanup: everything below
+    # is process reaping and file removal, while everything above is the work a
+    # user waits on (commit, PR, summary, proof). Emitting before cleanup also
+    # guarantees the event is written even if a later reap kills this shell.
+    if [ -n "${_teardown_t0:-}" ]; then
+        emit_stage_complete "teardown" "pass" "$_teardown_t0"
+    fi
+
     # Cleanup
     if type app_runner_cleanup &>/dev/null; then
         app_runner_cleanup

package/autonomy/verify.sh

@@ -368,15 +368,28 @@ _verify_zero_tests_executed() {
                 [ -n "$_zt_f" ] || continue
                 _zt_bases="${_zt_bases}${_zt_f}"$'\n'"$(basename "$_zt_f")"$'\n'
             done
-            local _zt_real=0 _zt_line _zt_label
+            local _zt_real=0 _zt_line _zt_label _zt_matches
+            _zt_matches=$(printf '%s\n' "$_zt_out" | grep -E '^(ok|not ok) [0-9]+ - ' 2>/dev/null || true)
             while IFS= read -r _zt_line; do
+                [ -n "$_zt_line" ] || continue
                 _zt_label="${_zt_line#* - }"
                 case "$_zt_bases" in
                     *$'\n'"$_zt_label"$'\n'*) continue ;;
                 esac
                 _zt_real=$((_zt_real + 1))
-            done < <(printf '%s\n' "$_zt_out" | grep -E '^(ok|not ok) [0-9]+ - ' 2>/dev/null)
-            [ "$_zt_real" -eq 0 ] && return 0
+            done << ZT_MATCHES_EOF
+$_zt_matches
+ZT_MATCHES_EOF
+            [ "$_zt_real" -gt 0 ] && return 1
+
+            # Node 26 defaults to the human-readable spec reporter under npm
+            # scripts. It has no TAP ok-lines, so an absent match is not proof
+            # that zero tests ran. Only classify zero tests when the output is
+            # positively identifiable as TAP; unknown/custom reporter shapes
+            # remain a passing run instead of becoming a false CONCERN.
+            case "$_zt_out" in
+                *"TAP version"*|*$'\n# tests '*|"# tests "*) return 0 ;;
+            esac
             return 1
             ;;
         jest)

package/bin/loki

@@ -188,7 +188,7 @@ fi
 # error regardless of which subcommand they invoke.
 if [ "${LOKI_PROVIDER:-}" = "gemini" ]; then
     echo "Error: Provider 'gemini' is deprecated as of v7.5.18 and has been removed." >&2
-    echo "Active providers: claude, codex, cline, aider" >&2
+    echo "Active providers: claude, codex, cline, aider, opencode" >&2
     echo "Unset LOKI_PROVIDER or use: LOKI_PROVIDER=claude" >&2
     exit 1
 fi
@@ -273,8 +273,19 @@ _loki_start_needs_bash() {
     # $@ = the start args (already know $1 = start). Return 0 (divert to bash) if
     # any bash-only orchestration flag or an issue-ref spec is present.
     local a
+    local explicit_provider=""
+    local provider_value_next=0
     for a in "$@"; do
+        if [ "$provider_value_next" = "1" ]; then
+            explicit_provider="$a"
+            provider_value_next=0
+            continue
+        fi
         case "$a" in
+            --provider)
+                provider_value_next=1 ;;
+            --provider=*)
+                explicit_provider="${a#--provider=}" ;;
             --parallel|--bg|--background|--github|--api|--sandbox \
             |--fast|--repo-fast|--full|--repo-full \
             |--bmad-project|--openspec \
@@ -296,6 +307,19 @@ _loki_start_needs_bash() {
         esac
     done
     unset _loki_iso_next
+
+    # The Bun RARV loop has not ported the opencode invoker yet. Keep the
+    # released, autonomous shell adapter reachable when SDK mode is enabled
+    # instead of accepting the selection and then failing after intake. CLI
+    # selection wins over env, which wins over the project-level saved choice.
+    local effective_provider="$explicit_provider"
+    if [ -z "$effective_provider" ] && [ -n "${LOKI_PROVIDER:-}" ]; then
+        effective_provider="$LOKI_PROVIDER"
+    fi
+    if [ -z "$effective_provider" ] && [ -f "${PWD}/.loki/state/provider" ]; then
+        effective_provider="$(sed -n '1p' "${PWD}/.loki/state/provider" 2>/dev/null || true)"
+    fi
+    [ "$effective_provider" = "opencode" ] && return 0
     return 1
 }
 if [ "${1:-}" = "start" ] && { [ "${LOKI_SDK_LOOP:-}" = "1" ] || [ "${LOKI_SDK_LOOP:-}" = "true" ]; }; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.22.12"
+__version__ = "9.24.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/control.py

@@ -20,10 +20,11 @@ import tempfile
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
+from urllib.parse import urlsplit
 
-from fastapi import Depends, FastAPI, HTTPException
+from fastapi import Depends, FastAPI, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import StreamingResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from pydantic import BaseModel
 
 # Auth gating for the standalone control app.
@@ -56,6 +57,63 @@ except Exception:  # pragma: no cover - defensive fallback for non-package runs
 
 _CONTROL_DEP = _require_control_scope()
 
+
+def _normalized_http_origin(value: str) -> tuple[str, str, int] | None:
+    """Return a comparable browser origin, or ``None`` when malformed.
+
+    Origin is scheme + host + effective port. Paths, credentials, queries and
+    fragments are never valid in an Origin header. Normalising default ports
+    makes ``https://host`` and ``https://host:443`` equivalent without doing
+    loose prefix/suffix matching on attacker-controlled text.
+    """
+    try:
+        parsed = urlsplit(value.strip())
+        if (
+            parsed.scheme.lower() not in ("http", "https")
+            or not parsed.hostname
+            or parsed.username is not None
+            or parsed.password is not None
+            or parsed.path not in ("", "/")
+            or parsed.query
+            or parsed.fragment
+        ):
+            return None
+        port = parsed.port
+    except (TypeError, ValueError):
+        return None
+    if port is None:
+        port = 443 if parsed.scheme.lower() == "https" else 80
+    return parsed.scheme.lower(), parsed.hostname.lower(), port
+
+
+def browser_mutation_origin_allowed(
+    request: Request, allowed_origins: list[str]
+) -> bool:
+    """Allow non-browser clients, same-origin pages and explicit CORS origins.
+
+    CORS controls whether a browser may *read* a response; it does not stop a
+    simple cross-origin POST from being sent. State-changing routes therefore
+    need their own check. Browsers always attach Origin to cross-origin fetches,
+    while CLI/SDK/local health clients commonly omit it, so absence preserves
+    the existing local-first API. A present malformed or unrelated origin is
+    refused before route code can touch disk or processes.
+    """
+    supplied = request.headers.get("origin")
+    if supplied is None:
+        return True
+    if "*" in allowed_origins:
+        return True
+    supplied_origin = _normalized_http_origin(supplied)
+    if supplied_origin is None:
+        return False
+    request_origin = _normalized_http_origin(str(request.base_url))
+    if supplied_origin == request_origin:
+        return True
+    return any(
+        supplied_origin == _normalized_http_origin(candidate)
+        for candidate in allowed_origins
+    )
+
 # Configuration
 LOKI_DIR = Path(os.environ.get("LOKI_DIR", ".loki"))
 STATE_DIR = LOKI_DIR / "state"
@@ -202,16 +260,42 @@ app = FastAPI(
 # CORS middleware for dashboard frontend - restricted to localhost by default.
 # Set LOKI_DASHBOARD_CORS to override (comma-separated origins).
 _cors_default = "http://localhost:57374,http://127.0.0.1:57374"
-_cors_origins = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default).split(",")
+_cors_raw = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default)
+_cors_origins = [o.strip() for o in _cors_raw.split(",") if o.strip()]
+if "*" in _cors_origins or _cors_raw.strip() == "*":
+    if os.environ.get("LOKI_ENV") == "production":
+        raise RuntimeError(
+            "Wildcard CORS ('*') is not allowed in production. "
+            "Set LOKI_DASHBOARD_CORS to a specific origin list, "
+            "or set LOKI_ENV != production."
+        )
+    import logging
+
+    logging.getLogger(__name__).warning(
+        "LOKI_DASHBOARD_CORS is set to '*' -- all origins are allowed. "
+        "This is insecure for production deployments."
+    )
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=[o.strip() for o in _cors_origins if o.strip()],
+    allow_origins=_cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
 
 
+@app.middleware("http")
+async def browser_mutation_boundary(request: Request, call_next):
+    """Refuse cross-origin browser mutations before control side effects."""
+    if request.method in ("POST", "PUT", "PATCH", "DELETE"):
+        if not browser_mutation_origin_allowed(request, _cors_origins):
+            return JSONResponse(
+                status_code=403,
+                content={"detail": "cross-origin mutation refused"},
+            )
+    return await call_next(request)
+
+
 # Request/Response models
 class StartRequest(BaseModel):
     """Request body for starting a Loki Mode session."""